Apache Camel camel-oauth: Authentication bypass via fail-open processors
Summary
The camel-oauth component of Apache Camel, which protects routes with OAuth authentication, does not stop processing when authentication cannot be completed. Requests that fail authentication continue to the protected part of the route as if they had succeeded. A remote, unauthenticated attacker can reach protected functionality on routes that require OAuth, without special configuration or prior access. Apache rates the vulnerability CVSS 8.2 (High).
Affected
- Apache Camel 4.11.0 up to but excluding 4.18.5
- Apache Camel 4.19.0 up to but excluding 4.22.1
- Camel 4.14.x (end of life, not fixed; move to 4.18.5 or later)
Fixed in
- Apache Camel 4.18.5 (4.18.x LTS)
- Apache Camel 4.22.1 (4.22.x LTS)
- Apache Camel 4.23.0 (recommended target)
Workaround
- Add an explicit authorization check after the OAuth processor instead of relying on the processor to stop the exchange.
- Verify that the route stops on failure, for example by testing requests with missing or invalid credentials in a test environment.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No in-the-wild exploitation was confirmed at the time of research.
- A vulnerability aggregator lists a public proof-of-concept reproducer; its content has not been verified.
Our recommendation
- Inventory Java applications and middleware for camel-oauth and Apache Camel versions.
- Upgrade to Apache Camel 4.23.0, or to 4.18.5 or 4.22.1 if the current branch must be kept.
- Treat the patch as urgent if a Camel route using camel-oauth is reachable from the internet.
- Review logs for requests that reached protected routes without valid tokens.
- Ask software vendors whether their products embed Camel and camel-oauth, and which version they use.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
oscerd/CVE-2026-80312
Research sources
- Apache Camel security advisory CVE-2026-80312 camel.apache.org
- Apache Camel 4.23.0 security advisories batch camel.apache.org
- Fix pull request 25567 (main) github.com
- Backport pull request 25575 (camel-4.22.x) github.com
- Backport pull request 25576 (camel-4.18.x) github.com
- Apache Jira CAMEL-24411 issues.apache.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:47.
Original description (NVD)
Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.